CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29) ยท updates https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 On Nov 3 2026 VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel) that chain from an unauthenticated request to a root shell. The CWP user panel (port 2083) sends its login redirect without stopping execution (CVE-2026-73696), so an attacker-named module file is included before login (path traversal, CVE-2026-73695); the phpini_editor and protected_directory modules then give file write and command execution as the hosting user (CVE-2026-73697, CVE-2026-77876). From that foothold, the root-owned loopback user API on 127.0.0.1:2302 has ungated routes (CVE-2026-77877), root command injections in /v1/restoredatabase/, /v1/newpass/ and /v1/valid_token/ (CVE-2026-77878, CVE-2026-77880, CVE-2026-104080) and SQL injections in its access_token() gate and dashboard route (CVE-2026-77879, CVE-2026-77881). The only precondition is one valid hosting account name, which the panel confirms (302 vs 404). CWP fixed the bugs in stages without naming CVEs: 1.12 closed the pre-auth entry, 1.16 fixed the user-panel modules, and 1.27/1.29 (Oct 30-31) fixed the user API; all ten are fixed in 1.29. VulnCheck counts tens of thousands of internet-exposed CWP panels. No in-the-wild exploitation reported yet, but the previous CWP user-panel RCE (CVE-2025-48703) was mass-exploited and is in CISA KEV. en Tue, 03 Nov 2026 00:00:00 GMT CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): VulnCheck publishes the CWP2Shell write-up: two requests take an unauthenticated attacker with one valid account name to uid 0; it says operators should upgrade to 1.29 or later and keep ports 2083 and 2031/2087 off the internet. https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-03-13dbde2b Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce">Source</a></p> CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): The VulnCheck CNA publishes the ten CVE records (CVE-2026-73695 through CVE-2026-104080). https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-11-02-bfd660bd Mon, 02 Nov 2026 00:00:00 GMT critical <p><a href="https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php">Source</a></p> CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.29 requires a valid session on the user API routes and validates input, fixing CVE-2026-77877, -77878, -77881 and -104080 (after the 1.27 security review on Oct 30); all ten are now fixed. https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-10-31-32e421c7 Sat, 31 Oct 2026 00:00:00 GMT critical <p><a href="https://control-webpanel.com/changelog">Source</a></p> CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.16 build fixes the user-panel module bugs and two user API sinks (CVE-2026-73695, -73697, -77876, -77879, -77880); the root user API stays exploitable from any hosting account. https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-29-67f5b7cf Tue, 29 Sep 2026 00:00:00 GMT critical <p><a href="https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce">Source</a></p> CWP2Shell: Control Web Panel before 1.29 has an unauthenticated-to-root RCE chain (10 CVEs, fixed in 1.29): CWP 1.12 adds the missing exit() after the user-panel login redirect and checks the session before including modules, closing the unauthenticated entry (CVE-2026-73696); the other bugs stay reachable from an authenticated account. https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026 https://pwn.watch/i/cwp2shell-control-web-panel-pre-auth-root-rce-chain-nov-2026#2026-09-08-c9525ff0 Tue, 08 Sep 2026 00:00:00 GMT critical <p><a href="https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce">Source</a></p>